Splunk Search

How to count IDs that are in the range between current_time and end_time for each second?

Path Finder

I want to count up IDs which are in the range between currenttime and endtime for each second.
For example, as for the following data source table, count 1 during 13:17:44 - 13:18:17 only for id: 1cf789ef, then count 2 during 13:18:17 - 13:18:21 for id: 1cf789ef and 3c05282c. Then I want it to be line chart.
Data Source

Output should look like...
alt text

How do I achieve this?

0 Karma
1 Solution

Contributor

If a line chart is the end goal, you could use concurrency to find the number of overlapping events, along with gentimes to create an event for every second. You will need to adjust the parameters of gentimes depending on the time you want your graph to show. This will not however list each individual id, only a count of the number of id's. Try the following search:

<your_current_search> | table id, current_time, end_time | eval starttime=strptime(current_time,"%Y/%m/%d %H:%M:%S") | eval endtime=strptime(end_time,"%Y/%m/%d %H:%M:%S") | eval duration = endtime-starttime | append [|gentimes start=01/21/2017:13:00:00 end=01/21/2017:15:00:00 increment=1s | eval type="gentimes" | eval duration=1] | concurrency start=starttime duration=duration | where type="gentimes" | eval concurrency=concurrency-1 | rename starttime AS _time | timechart span=1s max(concurrency) AS "Number of Id's"

View solution in original post

Esteemed Legend

Path Finder

Thank you! I didn't know concurrency command. Very useful!!

0 Karma

Contributor

If a line chart is the end goal, you could use concurrency to find the number of overlapping events, along with gentimes to create an event for every second. You will need to adjust the parameters of gentimes depending on the time you want your graph to show. This will not however list each individual id, only a count of the number of id's. Try the following search:

<your_current_search> | table id, current_time, end_time | eval starttime=strptime(current_time,"%Y/%m/%d %H:%M:%S") | eval endtime=strptime(end_time,"%Y/%m/%d %H:%M:%S") | eval duration = endtime-starttime | append [|gentimes start=01/21/2017:13:00:00 end=01/21/2017:15:00:00 increment=1s | eval type="gentimes" | eval duration=1] | concurrency start=starttime duration=duration | where type="gentimes" | eval concurrency=concurrency-1 | rename starttime AS _time | timechart span=1s max(concurrency) AS "Number of Id's"

View solution in original post

Path Finder

Great!!! This is exactly what I wanted.
Thank you!

0 Karma